F15-TS: Yes
Rationale
The selected WireGuard receiver validates MAC1 and, under load, checks source-bound cookies and applies an IP rate limit before consuming the handshake. Unknown peers do not create authorized sessions.
Assessment method
Pinned dependency/source inspection and official documentation; no runtime test
Source context
Tailscale go.mod and selected wireguard-go dependency
Outstanding qualification
Credits the WireGuard handshake boundary. Receiving, parsing and MAC work remain; an under-load cookie reply has a cost. It does not protect the incoming link or certify the coordinator, DERP TLS admission, or a service floor against authorized attackers.
Public sources
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/receive.go
- https://raw.githubusercontent.com/tailscale/tailscale/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/go.mod
- https://www.wireguard.com/protocol/
- https://tailscale.com/docs/reference/connection-types
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/receive.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/send.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/timers.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/constants.go
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round587.html
- round587-sources.json